Moore County Substation Attack: What We Know So Far

On the night of December 3 2022, residents of North Carolina’s Moore County lost power; subsequently, the Moore County Sheriff’s Office published a Facebook post indicating that the loss of power was being investigated as a “criminal occurrence” after utility companies observed “intentional” sabotage at multiple sites:

Moore County Sheriff Ronnie Fields reports that the mass power outage across the county is being investigated as a criminal occurrence.

Fact Check

Claim: Moore County Substation was Intentionally Sabotaged

Description: On the night of December 3, 2022, residents of North Carolina’s Moore County lost power due to intentional sabotage and vandalism at multiple sites. This led to a power outage in several communities across Moore County.

Rating: True

Rating Explanation: Based on reports from local authorities, community posts, and evidence present at the crime scenes, the claim is corroborated by substantial evidence and context, making it true.

Just after 7 pm on Saturday evening, December 3, 2022, several different communities across Moore County began experiencing power outages.

As utility companies began responding to the different substations, evidence was discovered that indicated that intentional vandalism had occurred at multiple sites.

Moore County Sheriff’s Deputies and various other law enforcement agencies within the county responded to the different areas and are providing further site security.

Anyone with any information about this act of violence should contact the Moore County Sheriff’s Office at 910-947-2931.

That post was shared at 11:47 PM Eastern. About 40 minutes previously, activist and writer Charlotte Clymer had tweeted about the Moore County power outage. Clymer stated that the outage “cut power to a drag show,” and described the sabotage as firearm-related:

In the early hours of December 4 2022, journalist Nick Martin tweeted about the incident. Martin described an intentional attack on “multiple power stations” as “obviously troubling”:

Later that morning, Moore County resident Andrew Wilkins published a popular thread about the Moore County substation attack. Wilkins described a number of serious problems cascading from that loss of power — including intermittent loss of cellular service, lack of access to well water for some residents, food spoilage, medical disruptions, and risks to drivers on the road:

A similar tweet on December 4 2022 from journalist Robert Evans (@IwriteOK) reported, among other things, that the outage had caused car crashes and injuries:

Evans linked to a December 4 2022 Fayetteville Observer article about the outage. The page was updated between Evans’ tweet and December 5 2022; the reporting originally began:

Multiple power substations in a North Carolina county were damaged by gunfire in an apparent act of criminal vandalism, leaving tens of thousands of people without electricity, authorities said.

The power outage across Moore County that began just after 7 p.m. Saturday [December 3 2022] is being investigated as a criminal act, Moore County Sheriff Ronnie Fields said in a Facebook post. More than 40,000 electric customers in the county remained without power on Sunday afternoon, [December 4 2022] according to poweroutage.us.

[…]

Southern Pines Fire Chief Mike Cameron said that two substations in the county were damaged by gunfire on Saturday [December 3 2022] and that a possible motive wasn’t clear. Cameron, also the assistant town manager, said that the information about the cause was given to him by Duke Energy. A Duke Energy spokesman didn’t immediately respond to an email asking about the gunfire.

By December 5 2022, the article was updated to reflect the longer-term effects of the attack. According to the Fayetteville Observer, authorities imposed a curfew, closed schools, and declared a state of emergency; essential services such as water, sewers, and hospitals were dependent on backup generators. Utility companies said that they anticipated a “multi-day restoration” effort due to the nature and extent of the damage inflicted:

Moore County residents are under a curfew Sunday night [December 4 2022] and for the foreseeable future as Duke Energy responds to a targeted attack on two substations that knocked out power to thousands of customers and could take days to repair, officials said at a press conference Sunday [December 4 2022] afternoon. The county has also declared a state of emergency.

Sheriff Ronnie Fields said gunshots were fired at the substations taking out the power first in Carthage about 7 p.m. then shortly thereafter when a second substation was attacked, spreading to the greater majority of the county [on December 3 2022]. More than 40,000 customers were without power.

A Duke Energy representative said the repair includes the replacement of substantial equipment.

“Unlike perhaps a storm where you can go in and reroute power somewhere else, that was not an option in this case, so repair has to be complete; in many cases, some of that equipment will have to be replaced,” said spokesman Jeff Brooks. “Recognizing that we are looking at a pretty sophisticated repair with some pretty large equipment and so we do want citizens of the town to be prepared that this will be a multi-day restoration for most customers extending potentially as long as Thursday [December 8 2022].”

In that reporting, Moore County Sheriff Ronnie Fields addressed speculation that the attack was carried out to prevent a scheduled drag show. Fields said that authorities had yet to identify a motive.

On December 5 2022, WTVD reported that over “30,000 Duke Energy customers woke up for the second straight morning in Moore County without any power as temperatures dipped below freezing,” making it clear that the sabotage could also be classified as an act of resilience targeting:

That coverage added that the Federal Bureau of Investigation (FBI) was involved:

National Security Council Spokesperson John Kirby gave the first response from the White House on the “intentional vandalism” at the power station, saying the administration is monitoring it closely, and shoring up infrastructure against external threats is a major priority.

“We’ve obviously been monitoring this very, very closely and we’re in contact with local officials. In fact, local officials and specifically local law enforcement are getting federal support on the investigation. So we’re going to obviously let that investigation play out. I think we’ve heard the President talk about this many times. He’s made critical infrastructure security and the resilience of that infrastructure, that regardless of whether it’s from natural threats, or manmade threats, he’s made it a priority since the very, very beginning,” Kirby said.

“An attack like this on critical infrastructure is a serious, intentional crime and I expect state and federal authorities to thoroughly investigate and bring those responsible to justice,” Gov. Roy Cooper wrote on Twitter.

An article from WRAL (originally published on December 3 2022) was updated with information about the severity of the attack:

The former head of the Federal Energy Regulatory Commission Jon Wellinghoff explained the severity of the damage to WRAL News.

“Somebody with a high-powered rifle puts a bullet through the case of a transformer and once it goes into the case of the transformer it hits the coils of the transformer, shorts it out, and it’s gone; That that device is no longer operable,” said Wellinghoff. “It can’t be fixed, it needs to be replaced. It cannot be repaired.”

Wellinghoff also shared insight into the repair process.

“A lot of these transformers also are sort of one-offs. It’s not like you can cookie-cutter replace them with another one from some other utility in the next county or the next state,” said Wellinghoff. “They have to be made sort of custom for the particular substation that they’re in. So if they don’t have spares for that particular substation, it could take a considerable amount of time.”

Both WRAL and the News & Observer published articles about social media posts by Emily Rainey shortly after the Moore County substation attack:

On her Facebook page, Emily Grace Rainey, an outspoken opponent of the drag show, posted an invitation to the protest at the theater. After the lights went out, Rainey, who became known in Moore County during the pandemic for her opposition to mask mandates, posted on Facebook that, “The power is out in Moore County and I know why.” Later, she posted that the Moore County Sheriff’s Office had come to her house to ask about the outage.

Rainey published that post just before 9 PM on December 3 2022. At 10:44 PM, Rainey tagged the Moore County Sheriff’s Office, and posted:

The Moore County Sheriff’s Office just checked in. I welcomed them to my home.

Sorry they wasted their time. I told them that God works in mysterious ways and is responsible for the outage. I used the opportunity to tell them about the immoral drag show and the blasphemies screamed by its supporters.

God is chastising Moore County. I thanked them for coming and wished them a good night. Thankful for the LEOs service, as always.

On December 5 2022, Twitter account @silentsamiam tweeted a photograph purportedly depicting Rainey with Moore County Sheriff Ronnie Fields. That image was published to a Facebook event page (“Back the Red, White & Blue“) on October 18 2022:

On December 5 2022, journalist Ari Drennan shared a CNN clip about the attack in Moore County, North Carolina. It referenced a November 30 2022 Department of Homeland Security (DHS) warning about domestic terrorism and infrastructure:

A November 30 2022 DHS bulletin was re-issued, extending a prior advisory that had been set to expire on that date to May 2023:

[On November 30 2022], Secretary of Homeland Security Alejandro N. Mayorkas issued a National Terrorism Advisory System (NTAS) Bulletin regarding the continued heightened threat environment across the United States. This is the seventh NTAS Bulletin issued by the Department of Homeland Security (DHS) since January 2021 and it replaces the current Bulletin that was set to expire at 2:00 PM ET [on November 30 2022].

“Our homeland continues to face a heightened threat environment —as we have seen, tragically, in recent acts of targeted violence— and is driven by violent extremists seeking to further a political or social goal or act on a grievance,” said Secretary Alejandro N. Mayorkas. “To keep Americans safe, DHS is committed to working with partners across every level of government, in the private sector, and in local communities by sharing information, equipping communities with training and resources, and providing millions of dollars in grant funding for security enhancement and prevention.”

Lone offenders and small groups motivated by a range of ideological beliefs and/or personal grievances continue to pose a persistent and lethal threat to the homeland. In the coming months, DHS expects the threat environment to remain heightened and threat actors could exploit several upcoming events to justify or commit acts of violence. These targets could include public gatherings, faith-based institutions, the LGBTQI+ community, schools, racial and religious minorities, government facilities and personnel, U.S. critical infrastructure, the media, and perceived ideological opponents.

Several recent attacks, plots, and threats of violence demonstrate the continued dynamic and complex nature of the threat environment in the United States. Domestic actors and foreign terrorist organizations —who remain intent on attacking America— continue to maintain a visible presence online in attempts to motivate supporters to conduct attacks in the homeland. Threat actors have recently mobilized to violence, citing factors such as reactions to current events and adherence to violent extremist ideologies, and some domestic violent extremists who have conducted attacks have cited previous attacks and attackers as inspiration.

As of December 5 2022, ReadyNC.gov indicated that more than 35,000 residents remained without power. More than 34,000 were in Moore County, with several hundred in two neighboring counties, Hoke and Harnett.

As for the drag show, it was not postponed by the outage:

Naomi Dix, a Durham-based drag artist, hosted the drag show. She said that despite the power outages, the stage still shined. When the lights went out, Dix asked the sold-out crowd to illuminate the room with their cellphone flashlights as she led them in singing “Halo” by Beyonce.

“It was a beautiful moment,” Dix said.

Michael Yates is a Cary resident who attended the counter-protest and the show with his husband and a group of friends. He said that the mood remained high as Naomi also led the audience in singing “Don’t Stop Believin'” by Journey. At the end of the show, attendees cheered and tipped Dix and her fellow performers.

“Our community does have a lot of bad things happen to us, and as drag artists they carry that pain,” he said.

As Dix continued to perform for about 45 minutes after the outage, Sunrise Theater Executive director Kevin Dietzel said he worked with security to monitor entrances and plan for audience members to safely exit the building. He said the full house still had a good time.

On December 3 2022, two substations in Moore County, North Carolina were attacked by unknown individuals. The Moore County Sheriff’s Office quickly disclosed that the power outage was an intentional act of sabotage. There was speculation that the act was carried out to cut power to a drag show; the event was not postponed due to the outage, however. As of December 5 2022, authorities had yet to identify a specific motive for the substation attacks, and utilities warned some residents could be without power for several days due to the extent of the damage to equipment.

Update, December 7 2022, 6:27 PM: On December 6 or 7 2022, NewsNationNow.com published an excerpt from a “recent federal law enforcement memo” about substation attacks, but did not identify the specific sender of the memo, nor a recipient or recipients.

It included what appeared to be an excerpt about attacks of a similar nature in Oregon in November 2022:

Power companies in Oregon and Washington have reported physical attacks on substations using hand tools, arson, firearms and metal chains possibly in response to an online call for attacks on critical infrastructure. … In recent attacks, criminal actors bypassed security by cutting the fence links, lighting nearby fires, shooting equipment from a distance or throwing objects over the fence and onto equipment.

[-] FEDERAL LAW ENFORCEMENT OFFICIALS

Portland, Oregon-based KOIN covered the bulletin, obtaining comment from one local utility and confirming a “deliberate” attack in “late November” 2022 in Clackamas:

Both PGE and Pacific Power confirmed to KOIN 6 News they are aware of these issues.

“PGE is aware of a deliberate physical attack on one of our substations in the Clackamas area that occurred in late November [2022]. We are actively cooperating with the FBI and cannot at this time share many details about this incident as it is currently under investigation. Our teams have assessed the damage and begun repair to the impacted facility.” — PGE spokesperson

“We are aware of the events and have security measures in place to protect our assets and keep our customers and employees safe and secure. We are working closely with industry partners and law enforcement to monitor the situation and will apply any emerging threat information to evaluate against our security measures to reduce the likelihood or impact of an attack where possible. As always, protecting the nation’s energy grid and ensuring a reliable and affordable supply of energy are top priorities for the energy industry and Pacific Power.” — Pacific Power spokesperson

As of December 7 2022, no suspects had yet been identified in connection with the Moore County substation attacks.

Update, February 6 2022, 5:15 PM: On February 6 2023, NBC News reported that two individuals were arrested by the Federal Bureau of Investigation (FBI), in connection with an alleged plot to disable substations in Baltimore:

The FBI captured two people, one a nationally known neo-Nazi leader, before they could launch an attack on Baltimore’s power grid that had the potential to “completely destroy this whole city,” authorities said Monday [February 6 2023].

The suspects, Brandon Russell and Sarah Clendaniel, were taken into custody [in February 2024], in Florida and Maryland, respectively, officials said.

Federal authorities described the alleged plot as “racially or ethnically motivated.” More than 61% of Baltimore residents are Black.

Russell, 27, is a founder of the Atomwaffen Division, a neo-Nazi group bent on “ushering in the collapse of civilization,” according to the Southern Poverty Law Center. The group admires Charles Manson and supports “the idea of lone wolf violence,” according to the Anti-Defamation League.

A Baltimore Banner article (published on the same day) described evidence collected by the FBI prior to the arrests connecting them to Atomwaffen Division, an international neo-Nazi network:

Believing she had months to live due to a terminal illness, a Catonsville woman and neo-Nazi sympathizer decided she wanted to “accomplish something worthwhile” and planned to destroy energy facilities surrounding Baltimore that would “permanently, completely lay this city to waste,” the FBI said.

Sarah Beth Clendaniel, 34, has been charged with conspiring with a neo-Nazi leader in Florida, Brandon Clint Russell, 27, who authorities say encouraged attacks that would cause a “cascading failure” of the energy grid.

Clendaniel was recorded telling an FBI source on Jan. 29 [2023] that she planned to shoot up energy substations ringing the Baltimore area, including in Norrisville, Reisterstown and Perry Hall, and sought to acquire firearms to carry out the attacks.

A New York Times report about the arrests mentioned increasing concern about white supremacist plots involving the electrical grid:

From 2016 to 2022, white supremacist plots targeting energy systems “dramatically increased in frequency,” according to a study released in September by researchers at the program on extremism at George Washington University

Over that period, 13 people associated with white supremacist movements were charged in federal courts with planning attacks on the energy sector, the study said, and 11 of those defendants were charged after 2020.

In February 2022, three men pleaded guilty to federal charges connected to a planned attack on substations after they had “conversations about how the possibility of the power being out for many months could cause war, even a race war, and induce the next Great Depression,” the Justice Department said.

That same month [of February 2022], a Department of Homeland Security bulletin warned that domestic violent extremists had recently aspired to disrupt electrical and communications systems as “a means to create chaos and advance ideological goals.”

At least nine substations in five states — Nevada, North Carolina, Oregon, South Carolina and Washington — were attacked throughout the winter months before the attacks, leaving tens of thousands of people without power.